Commit 83c7aba12780333a832148684d055698a2914463 | zig

author	Jacob Young <jacobly@ziglang.org> 2026-03-19 10:07:35-04:00
committer	Andrew Kelley <andrew@ziglang.org> 2026-03-20 19:23:48+01:00
log	83c7aba12780333a832148684d055698a2914463
tree	aa4dab38182392a5114105c1e4a1e72f25a810cd
parent	06b85a4fd00bee590ec908d9f32c0263982f13c3

windows: trigger automatic fetching of root certificates

9 files changed, 881 insertions(+), 449 deletions(-)

lib
- std
  - Io
    Threaded.zig
  - crypto
    Certificate.zig
    Certificate
    Bundle.zig
    Chain.zig
    tls
    Client.zig
  - http
    Client.zig
  - os
    windows.zig
    windows
    crypt32.zig
    win32error.zig

lib/std/Io/Threaded.zig+5-5

...	...	@@ -13587,7 +13587,7 @@ fn netLookupFallible(
13587	13587	//&cancel_token,
13588	13588	null)) {
13589	13589	// We must wait for the APC routine.
13590		.SUCCESS, .REQUEST_PENDING => \|status\| if (current_thread) \|_\| {
	13590	.SUCCESS, .DNS_REQUEST_PENDING => \|status\| if (current_thread) \|_\| {
13591	13591	while (!@atomicLoad(bool, &lookup_dns.done, .acquire)) {
13592	13592	// Once we get here we must not return from the function until the
13593	13593	// operation completes, thereby releasing references to `host_name_w`,
...	...	@@ -13604,16 +13604,16 @@ fn netLookupFallible(
13604	13604	}
13605	13605	} else switch (status) {
13606	13606	.SUCCESS => try lookup_dns.completedFallible(),
13607		.REQUEST_PENDING => unreachable, // `pQueryCompletionCallback` was `null`
	13607	.DNS_REQUEST_PENDING => unreachable, // `pQueryCompletionCallback` was `null`
13608	13608	else => unreachable,
13609	13609	},
13610	13610	else => \|status\| lookup_dns.results.QueryStatus = status,
13611	13611	}
13612	13612	switch (lookup_dns.results.QueryStatus) {
13613	13613	.SUCCESS => return,
13614		.REQUEST_PENDING => unreachable, // already handled
13615		.INVALID_NAME, .NO_RECORDS => return error.UnknownHostName,
13616		else => \|status\| return windows.unexpectedError(@enumFromInt(@intFromEnum(status))),
	13614	.DNS_REQUEST_PENDING => unreachable, // already handled
	13615	.INVALID_NAME, .DNS_INFO_NO_RECORDS => return error.UnknownHostName,
	13616	else => \|err\| return windows.unexpectedError(err),
13617	13617	}
13618	13618	}
13619	13619

lib/std/crypto/Certificate.zig+5

...	...	@@ -2,6 +2,10 @@ buffer: []const u8,
2	2	index: u32,
3	3
4	4	pub const Bundle = @import("Certificate/Bundle.zig");
	5	pub const Chain = switch (builtin.os.tag) {
	6	else => void, // not a shim to also avoid expensive caller logic
	7	.windows => @import("Certificate/Chain.zig"),
	8	};
5	9
6	10	pub const Version = enum { v1, v2, v3 };
7	11
...	...	@@ -844,6 +848,7 @@ fn verifyEd25519(
844	848	};
845	849	}
846	850
	851	const builtin = @import("builtin");
847	852	const std = @import("../std.zig");
848	853	const crypto = std.crypto;
849	854	const mem = std.mem;

lib/std/crypto/Certificate/Bundle.zig+7-5

...	...	@@ -20,8 +20,10 @@ const der = Certificate.der;
20	20	const base64 = std.base64.standard.decoderWithIgnore(" \t\r\n");
21	21
22	22	/// The key is the contents slice of the subject.
23		map: std.HashMapUnmanaged(der.Element.Slice, u32, MapContext, std.hash_map.default_max_load_percentage) = .empty,
24		bytes: std.ArrayList(u8) = .empty,
	23	map: std.HashMapUnmanaged(der.Element.Slice, u32, MapContext, std.hash_map.default_max_load_percentage),
	24	bytes: std.ArrayList(u8),
	25
	26	pub const empty: Bundle = .{ .map = .empty, .bytes = .empty };
25	27
26	28	pub const VerifyError = Certificate.Parsed.VerifyError \|\| error{
27	29	CertificateIssuerNotFound,
...	...	@@ -153,11 +155,11 @@ fn rescanWindows(cb: *Bundle, gpa: Allocator, io: Io, now: Io.Timestamp) RescanW
153	155	const w = std.os.windows;
154	156	const GetLastError = w.GetLastError;
155	157	const root = [4:0]u16{ 'R', 'O', 'O', 'T' };
156		const store = w.crypt32.CertOpenSystemStoreW(null, &root) orelse switch (GetLastError()) {
	158	const store = w.crypt32.CertOpenSystemStoreW(.NULL, &root) orelse switch (GetLastError()) {
157	159	.FILE_NOT_FOUND => return error.FileNotFound,
158	160	else => \|err\| return w.unexpectedError(err),
159	161	};
160		defer _ = w.crypt32.CertCloseStore(store, 0);
	162	defer assert(w.crypt32.CertCloseStore(store, .{ .CHECK = std.debug.runtime_safety }).toBool());
161	163
162	164	const now_sec = now.toSeconds();
163	165
...	...	@@ -335,7 +337,7 @@ test "scan for OS-provided certificates" {
335	337	const io = std.testing.io;
336	338	const gpa = std.testing.allocator;
337	339
338		var bundle: Bundle = .{};
	340	var bundle: Bundle = .empty;
339	341	defer bundle.deinit(gpa);
340	342
341	343	const now = Io.Clock.real.now(io);

lib/std/crypto/Certificate/Chain.zig created+95

...	...	@@ -0,0 +1,95 @@
	1	//! A sequence of certificates, where each certificate is authenticated by the next certificate.
	2	const Chain = @This();
	3
	4	store: ?crypt32.HCERTSTORE,
	5	primary: ?*const crypt32.CERT_CONTEXT,
	6
	7	pub const empty: Chain = .{ .store = null, .primary = null };
	8
	9	pub fn deinit(chain: *Chain) void {
	10	if (chain.primary) \|primary\| assert(crypt32.CertFreeCertificateContext(primary).toBool());
	11	if (chain.store) \|store\| if (!crypt32.CertCloseStore(store, .{
	12	.CHECK = std.debug.runtime_safety,
	13	}).toBool()) std.os.windows.unexpectedError(std.os.windows.GetLastError()) catch unreachable;
	14	chain.* = .empty;
	15	}
	16
	17	pub fn addCert(chain: *Chain, cert: []const u8) std.Io.UnexpectedError!void {
	18	const store = chain.store orelse store: {
	19	const store = crypt32.CertOpenStore(
	20	.MEMORY,
	21	.{},
	22	.NULL,
	23	.{},
	24	null,
	25	) orelse return std.os.windows.unexpectedError(std.os.windows.GetLastError());
	26	chain.store = store;
	27	break :store store;
	28	};
	29	if (!crypt32.CertAddEncodedCertificateToStore(
	30	store,
	31	.{ .CERT = .ASN },
	32	cert.ptr,
	33	@intCast(cert.len),
	34	.ALWAYS,
	35	if (chain.primary) \|_\| null else &chain.primary,
	36	).toBool()) return std.os.windows.unexpectedError(std.os.windows.GetLastError());
	37	}
	38
	39	pub const VerifyError = error{
	40	TlsCertificateNotVerified,
	41	} \|\| std.Io.UnexpectedError;
	42
	43	pub fn verify(chain: *const Chain, now: std.Io.Timestamp) VerifyError!void {
	44	const now_win = @divFloor(now.nanoseconds - std.time.epoch.windows * std.time.ns_per_s, 100);
	45	var cert_chain: *const crypt32.CERT_CHAIN.CONTEXT = undefined;
	46	if (!crypt32.CertGetCertificateChain(
	47	.CURRENT_USER,
	48	chain.primary orelse return error.TlsCertificateNotVerified,
	49	&.{
	50	.dwLowDateTime = @bitCast(@as(i32, @truncate(now_win >> 0))),
	51	.dwHighDateTime = @bitCast(@as(i32, @intCast(now_win >> 32))),
	52	},
	53	null,
	54	&.{ .RequestedUsage = .{ .dwType = .AND, .Usage = .{
	55	.cUsageIdentifier = ALLOWED_EKUS.len,
	56	.rgpszUsageIdentifier = &ALLOWED_EKUS,
	57	} } },
	58	.{ .REVOCATION_CHECK_END_CERT = true, .REVOCATION_ACCUMULATIVE_TIMEOUT = true },
	59	null,
	60	&cert_chain,
	61	).toBool()) return std.os.windows.unexpectedError(std.os.windows.GetLastError());
	62	defer crypt32.CertFreeCertificateChain(cert_chain);
	63	var status: crypt32.CERT_CHAIN.POLICY.STATUS = .{
	64	.dwError = undefined,
	65	.lChainIndex = undefined,
	66	.lElementIndex = undefined,
	67	.pvExtraPolicyStatus = undefined,
	68	};
	69	if (!crypt32.CertVerifyCertificateChainPolicy(
	70	.SSL,
	71	cert_chain,
	72	&.{
	73	.dwFlags = .{
	74	.IGNORE_END_REV_UNKNOWN = true,
	75	.IGNORE_CTL_SIGNER_REV_UNKNOWN = true,
	76	.IGNORE_CA_REV_UNKNOWN = true,
	77	.IGNORE_ROOT_REV_UNKNOWN = true,
	78	},
	79	.pvExtraPolicyPara = @constCast(&crypt32.HTTPSPolicyCallbackData{ .dwAuthType = .SERVER }),
	80	},
	81	&status,
	82	).toBool()) return std.os.windows.unexpectedError(std.os.windows.GetLastError());
	83	switch (status.dwError) {
	84	.SUCCESS => return,
	85	.CERT_E_UNTRUSTEDROOT => return error.TlsCertificateNotVerified,
	86	else => \|err\| return std.os.windows.unexpectedError(err),
	87	}
	88	}
	89
	90	const ALLOWED_EKUS = [_][*:0]const u8{"1.3.6.1.5.5.7.3.1"};
	91
	92	const assert = std.debug.assert;
	93	const builtin = @import("builtin");
	94	const std = @import("std");
	95	const crypt32 = std.os.windows.crypt32;

lib/std/crypto/tls/Client.zig+65-11

...	...	@@ -103,15 +103,20 @@ pub const Options = struct {
103	103	/// self-signed certificate.
104	104	self_signed,
105	105	/// Verify that the server certificate is authorized by a given ca bundle.
106		bundle: Certificate.Bundle,
	106	bundle: struct {
	107	gpa: std.mem.Allocator,
	108	io: std.Io,
	109	lock: *std.Io.RwLock,
	110	bundle: *Certificate.Bundle,
	111	},
107	112	},
108	113	write_buffer: []u8,
109	114	read_buffer: []u8,
110	115	/// Cryptographically secure random bytes. The pointer is not captured; data is only
111	116	/// read during `init`.
112	117	entropy: *const [entropy_len]u8,
113		/// Current time according to the wall clock / calendar, in seconds.
114		realtime_now_seconds: i64,
	118	/// Current time according to the wall clock / calendar.
	119	realtime_now: std.Io.Timestamp,
115	120
116	121	/// If non-null, ssl secrets are logged to this stream. Creating such a log file allows
117	122	/// other programs with access to that file to decrypt all traffic over this connection.
...	...	@@ -135,8 +140,6 @@ pub const Options = struct {
135	140	};
136	141
137	142	const InitError = error{
138		WriteFailed,
139		ReadFailed,
140	143	InsufficientEntropy,
141	144	DiskQuota,
142	145	LockViolation,
...	...	@@ -182,7 +185,7 @@ const InitError = error{
182	185	NotSquare,
183	186	NonCanonical,
184	187	WeakPublicKey,
185		};
	188	} \|\| std.Io.Writer.Error \|\| std.Io.Reader.ShortError \|\| std.Io.Cancelable;
186	189
187	190	/// Initiates a TLS handshake and establishes a TLSv1.2 or TLSv1.3 session.
188	191	///
...	...	@@ -286,6 +289,8 @@ pub fn init(input: Reader, output: Writer, options: Options) InitError!Client
286	289	}
287	290
288	291	var tls_version: tls.ProtocolVersion = undefined;
	292	var chain: Certificate.Chain = if (Certificate.Chain != void) .empty;
	293	defer if (Certificate.Chain != void) chain.deinit();
289	294	// These are used for two purposes:
290	295	// * Detect whether a certificate is the first one presented, in which case
291	296	// we need to verify the host name.
...	...	@@ -327,7 +332,7 @@ pub fn init(input: Reader, output: Writer, options: Options) InitError!Client
327	332	var handshake_cipher: tls.HandshakeCipher = undefined;
328	333	var main_cert_pub_key: CertificatePublicKey = undefined;
329	334	var tls12_negotiated_group: ?tls.NamedGroup = null;
330		const now_sec = options.realtime_now_seconds;
	335	const now_sec = options.realtime_now.toSeconds();
331	336
332	337	var cleartext_fragment_start: usize = 0;
333	338	var cleartext_fragment_end: usize = 0;
...	...	@@ -615,7 +620,9 @@ pub fn init(input: Reader, output: Writer, options: Options) InitError!Client
615	620	else => unreachable,
616	621	}
617	622	const certs_size = hsd.decode(u24);
618		var certs_decoder = try hsd.sub(certs_size);
	623	const certs = try hsd.sub(certs_size);
	624
	625	var certs_decoder = certs;
619	626	while (!certs_decoder.eof()) {
620	627	try certs_decoder.ensure(3);
621	628	const cert_size = certs_decoder.decode(u24);
...	...	@@ -657,7 +664,11 @@ pub fn init(input: Reader, output: Writer, options: Options) InitError!Client
657	664	handshake_state = .trust_chain_established;
658	665	break :cert;
659	666	},
660		.bundle => \|ca_bundle\| if (ca_bundle.verify(subject, now_sec)) \|_\| {
	667	.bundle => \|ca\| if (verify: {
	668	try ca.lock.lockShared(ca.io);
	669	defer ca.lock.unlockShared(ca.io);
	670	break :verify ca.bundle.verify(subject, now_sec);
	671	}) {
661	672	handshake_state = .trust_chain_established;
662	673	break :cert;
663	674	} else \|err\| switch (err) {
...	...	@@ -669,6 +680,25 @@ pub fn init(input: Reader, output: Writer, options: Options) InitError!Client
669	680	prev_cert = subject;
670	681	cert_index += 1;
671	682	}
	683
	684	if (Certificate.Chain != void) {
	685	certs_decoder = certs;
	686	while (!certs_decoder.eof()) {
	687	try certs_decoder.ensure(3);
	688	const cert_size = certs_decoder.decode(u24);
	689	const certd = try certs_decoder.sub(cert_size);
	690	chain.addCert(certd.rest()) catch \|err\| switch (err) {
	691	error.Unexpected => return error.TlsCertificateNotVerified,
	692	};
	693	if (tls_version == .tls_1_3) {
	694	try certs_decoder.ensure(2);
	695	const total_ext_size = certs_decoder.decode(u16);
	696	const all_extd = try certs_decoder.sub(total_ext_size);
	697	_ = all_extd;
	698	}
	699	}
	700	}
	701
672	702	cert_buf_index += 1;
673	703	},
674	704	.server_key_exchange => {
...	...	@@ -676,7 +706,7 @@ pub fn init(input: Reader, output: Writer, options: Options) InitError!Client
676	706	if (cipher_state != .cleartext) return error.TlsUnexpectedMessage;
677	707	switch (handshake_state) {
678	708	.trust_chain_established => {},
679		.certificate => return error.TlsCertificateNotVerified,
	709	.certificate => try tryDownloadRootCert(&chain, &options),
680	710	else => return error.TlsUnexpectedMessage,
681	711	}
682	712
...	...	@@ -795,7 +825,7 @@ pub fn init(input: Reader, output: Writer, options: Options) InitError!Client
795	825	if (cipher_state != .handshake) return error.TlsUnexpectedMessage;
796	826	switch (handshake_state) {
797	827	.trust_chain_established => {},
798		.certificate => return error.TlsCertificateNotVerified,
	828	.certificate => try tryDownloadRootCert(&chain, &options),
799	829	else => return error.TlsUnexpectedMessage,
800	830	}
801	831	switch (handshake_cipher) {
...	...	@@ -1571,6 +1601,30 @@ const CertificatePublicKey = struct {
1571	1601	}
1572	1602	};
1573	1603
	1604	fn tryDownloadRootCert(chain: Certificate.Chain, options: const Options) !void {
	1605	if (Certificate.Chain != void) switch (options.ca) {
	1606	else => {},
	1607	.bundle => \|ca\| {
	1608	chain.verify(options.realtime_now) catch \|err\| switch (err) {
	1609	error.Unexpected => return error.TlsCertificateNotVerified,
	1610	else => \|e\| return e,
	1611	};
	1612	var bundle: Certificate.Bundle = .empty;
	1613	defer bundle.deinit(ca.gpa);
	1614	if (bundle.rescan(ca.gpa, ca.io, options.realtime_now)) {
	1615	try ca.lock.lock(ca.io);
	1616	defer ca.lock.unlock(ca.io);
	1617	std.mem.swap(Certificate.Bundle, ca.bundle, &bundle);
	1618	} else \|err\| switch (err) {
	1619	error.Canceled => \|e\| return e,
	1620	else => {},
	1621	}
	1622	return; // the os has verified the certificate for us
	1623	},
	1624	};
	1625	return error.TlsCertificateNotVerified;
	1626	}
	1627
1574	1628	/// The priority order here is chosen based on what crypto algorithms Zig has
1575	1629	/// available in the standard library as well as what is faster. Following are
1576	1630	/// a few data points on the relative performance of these algorithms.

lib/std/http/Client.zig+24-14

...	...	@@ -29,8 +29,8 @@ allocator: Allocator,
29	29	/// Used for opening TCP connections.
30	30	io: Io,
31	31
32		ca_bundle: if (disable_tls) void else std.crypto.Certificate.Bundle = if (disable_tls) {} else .{},
33		ca_bundle_mutex: Io.Mutex = .init,
	32	ca_bundle_lock: if (disable_tls) void else Io.RwLock = if (disable_tls) {} else .init,
	33	ca_bundle: if (disable_tls) void else std.crypto.Certificate.Bundle = if (disable_tls) {} else .empty,
34	34	/// Used both for the reader and writer buffers.
35	35	tls_buffer_size: if (disable_tls) u0 else usize = if (disable_tls) 0 else std.crypto.tls.Client.min_buffer_len,
36	36	/// If non-null, ssl secrets are logged to a stream. Creating such a stream
...	...	@@ -344,12 +344,17 @@ pub const Connection = struct {
344	344	&tls.connection.stream_writer.interface,
345	345	.{
346	346	.host = .{ .explicit = remote_host.bytes },
347		.ca = .{ .bundle = client.ca_bundle },
	347	.ca = .{ .bundle = .{
	348	.gpa = client.allocator,
	349	.io = client.io,
	350	.lock = &client.ca_bundle_lock,
	351	.bundle = &client.ca_bundle,
	352	} },
348	353	.ssl_key_log = client.ssl_key_log,
349	354	.read_buffer = tls_read_buffer,
350	355	.write_buffer = socket_write_buffer,
351	356	.entropy = &random_buffer,
352		.realtime_now_seconds = client.now.?.toSeconds(),
	357	.realtime_now = client.now.?,
353	358	// This is appropriate for HTTPS because the HTTP headers contain
354	359	// the content length which is used to detect truncation attacks.
355	360	.allow_truncation_attacks = true,
...	...	@@ -1693,19 +1698,24 @@ pub fn request(
1693	1698
1694	1699	const protocol = Protocol.fromUri(uri) orelse return error.UnsupportedUriScheme;
1695	1700
1696		if (protocol == .tls) {
	1701	if (protocol == .tls) tls: {
1697	1702	if (disable_tls) unreachable;
1698	1703	{
1699		client.ca_bundle_mutex.lockUncancelable(io);
1700		defer client.ca_bundle_mutex.unlock(io);
1701
1702		if (client.now == null) {
1703		const now = Io.Clock.real.now(io);
1704		client.now = now;
1705		client.ca_bundle.rescan(client.allocator, io, now) catch
1706		return error.CertificateBundleLoadFailure;
1707		}
	1704	try client.ca_bundle_lock.lockShared(io);
	1705	defer client.ca_bundle_lock.unlockShared(io);
	1706	if (client.now != null) break :tls;
1708	1707	}
	1708	var bundle: std.crypto.Certificate.Bundle = .empty;
	1709	defer bundle.deinit(client.allocator);
	1710	const now = Io.Clock.real.now(io);
	1711	bundle.rescan(client.allocator, io, now) catch \|err\| switch (err) {
	1712	error.Canceled => \|e\| return e,
	1713	else => return error.CertificateBundleLoadFailure,
	1714	};
	1715	try client.ca_bundle_lock.lock(io);
	1716	defer client.ca_bundle_lock.unlock(io);
	1717	client.now = now;
	1718	std.mem.swap(std.crypto.Certificate.Bundle, &client.ca_bundle, &bundle);
1709	1719	}
1710	1720
1711	1721	const connection = options.connection orelse c: {

lib/std/os/windows.zig+6-275

...	...	@@ -1545,281 +1545,7 @@ pub const DNS = struct {
1545	1545
1546	1546	// ref: um/WinDNS.h
1547	1547
1548		pub const STATUS = enum(LONG) {
1549		/// The operation completed successfully.
1550		SUCCESS = 0,
1551		/// The parameter is incorrect.
1552		INVALID_PARAMETER = 87,
1553		/// The filename, directory name, or volume label syntax is incorrect.
1554		INVALID_NAME = 123,
1555		/// DNS server unable to interpret format.
1556		FORMAT_ERROR = 9001,
1557		/// DNS server failure.
1558		SERVER_FAILURE = 9002,
1559		/// DNS name does not exist.
1560		NAME_ERROR = 9003,
1561		/// DNS request not supported by name server.
1562		NOT_IMPLEMENTED = 9004,
1563		/// DNS operation refused.
1564		REFUSED = 9005,
1565		/// DNS name that ought not exist, does exist.
1566		YXDOMAIN = 9006,
1567		/// DNS RR set that ought not exist, does exist.
1568		YXRRSET = 9007,
1569		/// DNS RR set that ought to exist, does not exist.
1570		NXRRSET = 9008,
1571		/// DNS server not authoritative for zone.
1572		NOTAUTH = 9009,
1573		/// DNS name in update or prereq is not in zone.
1574		NOTZONE = 9010,
1575		/// DNS signature failed to verify.
1576		BADSIG = 9016,
1577		/// DNS bad key.
1578		BADKEY = 9017,
1579		/// DNS signature validity expired.
1580		BADTIME = 9018,
1581		/// Only the DNS server acting as the key master for the zone may perform this operation.
1582		KEYMASTER_REQUIRED = 9101,
1583		/// This operation is not allowed on a zone that is signed or has signing keys.
1584		NOT_ALLOWED_ON_SIGNED_ZONE = 9102,
1585		/// NSEC3 is not compatible with the RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC.
1586		///
1587		/// This value was also named DNS_INVALID_NSEC3_PARAMETERS
1588		NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 = 9103,
1589		/// The zone does not have enough signing keys. There must be at least one key signing key (KSK) and at least one zone signing key (ZSK).
1590		NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS = 9104,
1591		/// The specified algorithm is not supported.
1592		UNSUPPORTED_ALGORITHM = 9105,
1593		/// The specified key size is not supported.
1594		INVALID_KEY_SIZE = 9106,
1595		/// One or more of the signing keys for a zone are not accessible to the DNS server. Zone signing will not be operational until this error is resolved.
1596		SIGNING_KEY_NOT_ACCESSIBLE = 9107,
1597		/// The specified key storage provider does not support DPAPI++ data protection. Zone signing will not be operational until this error is resolved.
1598		KSP_DOES_NOT_SUPPORT_PROTECTION = 9108,
1599		/// An unexpected DPAPI++ error was encountered. Zone signing will not be operational until this error is resolved.
1600		UNEXPECTED_DATA_PROTECTION_ERROR = 9109,
1601		/// An unexpected crypto error was encountered. Zone signing may not be operational until this error is resolved.
1602		UNEXPECTED_CNG_ERROR = 9110,
1603		/// The DNS server encountered a signing key with an unknown version. Zone signing will not be operational until this error is resolved.
1604		UNKNOWN_SIGNING_PARAMETER_VERSION = 9111,
1605		/// The specified key service provider cannot be opened by the DNS server.
1606		KSP_NOT_ACCESSIBLE = 9112,
1607		/// The DNS server cannot accept any more signing keys with the specified algorithm and KSK flag value for this zone.
1608		TOO_MANY_SKDS = 9113,
1609		/// The specified rollover period is invalid.
1610		INVALID_ROLLOVER_PERIOD = 9114,
1611		/// The specified initial rollover offset is invalid.
1612		INVALID_INITIAL_ROLLOVER_OFFSET = 9115,
1613		/// The specified signing key is already in process of rolling over keys.
1614		ROLLOVER_IN_PROGRESS = 9116,
1615		/// The specified signing key does not have a standby key to revoke.
1616		STANDBY_KEY_NOT_PRESENT = 9117,
1617		/// This operation is not allowed on a zone signing key (ZSK).
1618		NOT_ALLOWED_ON_ZSK = 9118,
1619		/// This operation is not allowed on an active signing key.
1620		NOT_ALLOWED_ON_ACTIVE_SKD = 9119,
1621		/// The specified signing key is already queued for rollover.
1622		ROLLOVER_ALREADY_QUEUED = 9120,
1623		/// This operation is not allowed on an unsigned zone.
1624		NOT_ALLOWED_ON_UNSIGNED_ZONE = 9121,
1625		/// This operation could not be completed because the DNS server listed as the current key master for this zone is down or misconfigured. Resolve the problem on the current key master for this zone or use another DNS server to seize the key master role.
1626		BAD_KEYMASTER = 9122,
1627		/// The specified signature validity period is invalid.
1628		INVALID_SIGNATURE_VALIDITY_PERIOD = 9123,
1629		/// The specified NSEC3 iteration count is higher than allowed by the minimum key length used in the zone.
1630		INVALID_NSEC3_ITERATION_COUNT = 9124,
1631		/// This operation could not be completed because the DNS server has been configured with DNSSEC features disabled. Enable DNSSEC on the DNS server.
1632		DNSSEC_IS_DISABLED = 9125,
1633		/// This operation could not be completed because the XML stream received is empty or syntactically invalid.
1634		INVALID_XML = 9126,
1635		/// This operation completed, but no trust anchors were added because all of the trust anchors received were either invalid, unsupported, expired, or would not become valid in less than 30 days.
1636		NO_VALID_TRUST_ANCHORS = 9127,
1637		/// The specified signing key is not waiting for parental DS update.
1638		ROLLOVER_NOT_POKEABLE = 9128,
1639		/// Hash collision detected during NSEC3 signing. Specify a different user-provided salt, or use a randomly generated salt, and attempt to sign the zone again.
1640		NSEC3_NAME_COLLISION = 9129,
1641		/// NSEC is not compatible with the NSEC3-RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC3.
1642		NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1 = 9130,
1643		/// No records found for given DNS query.
1644		NO_RECORDS = 9501,
1645		/// Bad DNS packet.
1646		BAD_PACKET = 9502,
1647		/// No DNS packet.
1648		NO_PACKET = 9503,
1649		/// DNS error, check rcode.
1650		RCODE = 9504,
1651		/// Unsecured DNS packet.
1652		UNSECURE_PACKET = 9505,
1653		/// DNS query request is pending.
1654		REQUEST_PENDING = 9506,
1655		/// Invalid DNS type.
1656		INVALID_TYPE = 9551,
1657		/// Invalid IP address.
1658		INVALID_IP_ADDRESS = 9552,
1659		/// Invalid property.
1660		INVALID_PROPERTY = 9553,
1661		/// Try DNS operation again later.
1662		TRY_AGAIN_LATER = 9554,
1663		/// Record for given name and type is not unique.
1664		NOT_UNIQUE = 9555,
1665		/// DNS name does not comply with RFC specifications.
1666		NON_RFC_NAME = 9556,
1667		/// DNS name is a fully-qualified DNS name.
1668		FQDN = 9557,
1669		/// DNS name is dotted (multi-label).
1670		DOTTED_NAME = 9558,
1671		/// DNS name is a single-part name.
1672		SINGLE_PART_NAME = 9559,
1673		/// DNS name contains an invalid character.
1674		INVALID_NAME_CHAR = 9560,
1675		/// DNS name is entirely numeric.
1676		NUMERIC_NAME = 9561,
1677		/// The operation requested is not permitted on a DNS root server.
1678		NOT_ALLOWED_ON_ROOT_SERVER = 9562,
1679		/// The record could not be created because this part of the DNS namespace has been delegated to another server.
1680		NOT_ALLOWED_UNDER_DELEGATION = 9563,
1681		/// The DNS server could not find a set of root hints.
1682		CANNOT_FIND_ROOT_HINTS = 9564,
1683		/// The DNS server found root hints but they were not consistent across all adapters.
1684		INCONSISTENT_ROOT_HINTS = 9565,
1685		/// The specified value is too small for this parameter.
1686		DWORD_VALUE_TOO_SMALL = 9566,
1687		/// The specified value is too large for this parameter.
1688		DWORD_VALUE_TOO_LARGE = 9567,
1689		/// This operation is not allowed while the DNS server is loading zones in the background. Please try again later.
1690		BACKGROUND_LOADING = 9568,
1691		/// The operation requested is not permitted on against a DNS server running on a read-only DC.
1692		NOT_ALLOWED_ON_RODC = 9569,
1693		/// No data is allowed to exist underneath a DNAME record.
1694		NOT_ALLOWED_UNDER_DNAME = 9570,
1695		/// This operation requires credentials delegation.
1696		DELEGATION_REQUIRED = 9571,
1697		/// Name resolution policy table has been corrupted. DNS resolution will fail until it is fixed. Contact your network administrator.
1698		INVALID_POLICY_TABLE = 9572,
1699		/// DNS zone does not exist.
1700		ZONE_DOES_NOT_EXIST = 9601,
1701		/// DNS zone information not available.
1702		NO_ZONE_INFO = 9602,
1703		/// Invalid operation for DNS zone.
1704		INVALID_ZONE_OPERATION = 9603,
1705		/// Invalid DNS zone configuration.
1706		ZONE_CONFIGURATION_ERROR = 9604,
1707		/// DNS zone has no start of authority (SOA) record.
1708		ZONE_HAS_NO_SOA_RECORD = 9605,
1709		/// DNS zone has no Name Server (NS) record.
1710		ZONE_HAS_NO_NS_RECORDS = 9606,
1711		/// DNS zone is locked.
1712		ZONE_LOCKED = 9607,
1713		/// DNS zone creation failed.
1714		ZONE_CREATION_FAILED = 9608,
1715		/// DNS zone already exists.
1716		ZONE_ALREADY_EXISTS = 9609,
1717		/// DNS automatic zone already exists.
1718		AUTOZONE_ALREADY_EXISTS = 9610,
1719		/// Invalid DNS zone type.
1720		INVALID_ZONE_TYPE = 9611,
1721		/// Secondary DNS zone requires master IP address.
1722		SECONDARY_REQUIRES_MASTER_IP = 9612,
1723		/// DNS zone not secondary.
1724		ZONE_NOT_SECONDARY = 9613,
1725		/// Need secondary IP address.
1726		NEED_SECONDARY_ADDRESSES = 9614,
1727		/// WINS initialization failed.
1728		WINS_INIT_FAILED = 9615,
1729		/// Need WINS servers.
1730		NEED_WINS_SERVERS = 9616,
1731		/// NBTSTAT initialization call failed.
1732		NBSTAT_INIT_FAILED = 9617,
1733		/// Invalid delete of start of authority (SOA).
1734		SOA_DELETE_INVALID = 9618,
1735		/// A conditional forwarding zone already exists for that name.
1736		FORWARDER_ALREADY_EXISTS = 9619,
1737		/// This zone must be configured with one or more master DNS server IP addresses.
1738		ZONE_REQUIRES_MASTER_IP = 9620,
1739		/// The operation cannot be performed because this zone is shut down.
1740		ZONE_IS_SHUTDOWN = 9621,
1741		/// This operation cannot be performed because the zone is currently being signed. Please try again later.
1742		ZONE_LOCKED_FOR_SIGNING = 9622,
1743		/// Primary DNS zone requires datafile.
1744		PRIMARY_REQUIRES_DATAFILE = 9651,
1745		/// Invalid datafile name for DNS zone.
1746		INVALID_DATAFILE_NAME = 9652,
1747		/// Failed to open datafile for DNS zone.
1748		DATAFILE_OPEN_FAILURE = 9653,
1749		/// Failed to write datafile for DNS zone.
1750		FILE_WRITEBACK_FAILED = 9654,
1751		/// Failure while reading datafile for DNS zone.
1752		DATAFILE_PARSING = 9655,
1753		/// DNS record does not exist.
1754		RECORD_DOES_NOT_EXIST = 9701,
1755		/// DNS record format error.
1756		RECORD_FORMAT = 9702,
1757		/// Node creation failure in DNS.
1758		NODE_CREATION_FAILED = 9703,
1759		/// Unknown DNS record type.
1760		UNKNOWN_RECORD_TYPE = 9704,
1761		/// DNS record timed out.
1762		RECORD_TIMED_OUT = 9705,
1763		/// Name not in DNS zone.
1764		NAME_NOT_IN_ZONE = 9706,
1765		/// CNAME loop detected.
1766		CNAME_LOOP = 9707,
1767		/// Node is a CNAME DNS record.
1768		NODE_IS_CNAME = 9708,
1769		/// A CNAME record already exists for given name.
1770		CNAME_COLLISION = 9709,
1771		/// Record only at DNS zone root.
1772		RECORD_ONLY_AT_ZONE_ROOT = 9710,
1773		/// DNS record already exists.
1774		RECORD_ALREADY_EXISTS = 9711,
1775		/// Secondary DNS zone data error.
1776		SECONDARY_DATA = 9712,
1777		/// Could not create DNS cache data.
1778		NO_CREATE_CACHE_DATA = 9713,
1779		/// DNS name does not exist.
1780		NAME_DOES_NOT_EXIST = 9714,
1781		/// Could not create pointer (PTR) record.
1782		PTR_CREATE_FAILED = 9715,
1783		/// DNS domain was undeleted.
1784		DOMAIN_UNDELETED = 9716,
1785		/// The directory service is unavailable.
1786		DS_UNAVAILABLE = 9717,
1787		/// DNS zone already exists in the directory service.
1788		DS_ZONE_ALREADY_EXISTS = 9718,
1789		/// DNS server not creating or reading the boot file for the directory service integrated DNS zone.
1790		NO_BOOTFILE_IF_DS_ZONE = 9719,
1791		/// Node is a DNAME DNS record.
1792		NODE_IS_DNAME = 9720,
1793		/// A DNAME record already exists for given name.
1794		DNAME_COLLISION = 9721,
1795		/// An alias loop has been detected with either CNAME or DNAME records.
1796		ALIAS_LOOP = 9722,
1797		/// DNS AXFR (zone transfer) complete.
1798		AXFR_COMPLETE = 9751,
1799		/// DNS zone transfer failed.
1800		AXFR = 9752,
1801		/// Added local WINS server.
1802		ADDED_LOCAL_WINS = 9753,
1803		/// Secure update call needs to continue update request.
1804		CONTINUE_NEEDED = 9801,
1805		/// TCP/IP network protocol not installed.
1806		NO_TCPIP = 9851,
1807		/// No DNS servers configured for local system.
1808		NO_DNS_SERVERS = 9852,
1809		/// The specified directory partition does not exist.
1810		DP_DOES_NOT_EXIST = 9901,
1811		/// The specified directory partition already exists.
1812		DP_ALREADY_EXISTS = 9902,
1813		/// This DNS server is not enlisted in the specified directory partition.
1814		DP_NOT_ENLISTED = 9903,
1815		/// This DNS server is already enlisted in the specified directory partition.
1816		DP_ALREADY_ENLISTED = 9904,
1817		/// The directory partition is not available at this time. Please wait a few minutes and try again.
1818		DP_NOT_AVAILABLE = 9905,
1819		/// The operation failed because the domain naming master FSMO role could not be reached. The domain controller holding the domain naming master FSMO role is down or unable to service the request or is not running Windows Server 2003 or later.
1820		DP_FSMO_ERROR = 9906,
1821		_,
1822		};
	1548	pub const STATUS = Win32Error;
1823	1549
1824	1550	pub const TYPE = enum(WORD) {
1825	1551	A = 0x0001,
...	...	@@ -4458,6 +4184,11 @@ pub const STARTF_USESTDHANDLES = 0x00000100;
4458	4184	pub const THREAD_START_ROUTINE = fn (LPVOID) callconv(.winapi) DWORD;
4459	4185	pub const USER_THREAD_START_ROUTINE = fn (LPVOID) callconv(.winapi) NTSTATUS;
4460	4186
	4187	pub const FILETIME = extern struct {
	4188	dwLowDateTime: DWORD,
	4189	dwHighDateTime: DWORD,
	4190	};
	4191
4461	4192	pub const GUID = extern struct {
4462	4193	Data1: u32,
4463	4194	Data2: u16,

lib/std/os/windows/crypt32.zig+257-5

...	...	@@ -1,31 +1,283 @@
1	1	const std = @import("../../std.zig");
2	2	const windows = std.os.windows;
	3
3	4	const BOOL = windows.BOOL;
4	5	const DWORD = windows.DWORD;
5	6	const BYTE = windows.BYTE;
	7	const LONG = windows.LONG;
	8	const LPCSTR = windows.LPCSTR;
6	9	const LPCWSTR = windows.LPCWSTR;
	10	const FILETIME = windows.FILETIME;
	11	const HANDLE = windows.HANDLE;
	12
	13	// ref: um/wincrypt.h
	14
	15	pub const HCRYPTPROV_LEGACY = enum(usize) { NULL = 0 };
7	16
8	17	pub const CERT_INFO = *opaque {};
	18
	19	pub const CTL_USAGE = extern struct {
	20	cUsageIdentifier: DWORD,
	21	rgpszUsageIdentifier: [*]const LPCSTR,
	22	};
	23
	24	pub const CERT_ENHKEY_USAGE = CTL_USAGE;
	25
	26	pub const ENCODING = enum(u16) {
	27	UNSPECIFIED = 0x0000,
	28	ASN = 0x0001,
	29	NDR = 0x0002,
	30	_,
	31
	32	pub const TYPE = packed struct(DWORD) {
	33	CERT: ENCODING = .UNSPECIFIED,
	34	CMSG: ENCODING = .UNSPECIFIED,
	35	};
	36	};
	37
9	38	pub const HCERTSTORE = *opaque {};
	39
10	40	pub const CERT_CONTEXT = extern struct {
11		dwCertEncodingType: DWORD,
	41	dwCertEncodingType: ENCODING.TYPE,
12	42	pbCertEncoded: [*]BYTE,
13	43	cbCertEncoded: DWORD,
14	44	pCertInfo: CERT_INFO,
15	45	hCertStore: HCERTSTORE,
16	46	};
17	47
18		pub extern "crypt32" fn CertOpenSystemStoreW(
19		_: ?*const anyopaque,
20		szSubsystemProtocol: LPCWSTR,
	48	pub const CERT_STORE = struct {
	49	pub const PROV = enum(usize) {
	50	MSG = 1,
	51	MEMORY = 2,
	52	FILE = 3,
	53	REG = 4,
	54
	55	PKCS7 = 5,
	56	SERIALIZED = 6,
	57	FILENAME_A = 7,
	58	FILENAME_W = 8,
	59	SYSTEM_A = 9,
	60	SYSTEM_W = 10,
	61
	62	COLLECTION = 11,
	63	SYSTEM_REGISTRY_A = 12,
	64	SYSTEM_REGISTRY_W = 13,
	65	PHYSICAL_W = 14,
	66
	67	SMART_CARD_W = 15,
	68
	69	LDAP_W = 16,
	70	PKCS12 = 17,
	71
	72	/// LPCSTR
	73	_,
	74
	75	pub fn fromString(str: LPCSTR) PROV {
	76	return @enumFromInt(@intFromPtr(str));
	77	}
	78	};
	79
	80	pub const FLAG = packed struct(DWORD) {
	81	NO_CRYPT_RELEASE: bool = false,
	82	SET_LOCALIZED_NAME: bool = false,
	83	DEFER_CLOSE_UNTIL_LAST_FREE: bool = false,
	84	Reserved3: u1 = 0,
	85	DELETE: bool = false,
	86	UNSAFE_PHYSICAL: bool = false,
	87	SHARE_STORE: bool = false,
	88	SHARE_CONTEXT: bool = false,
	89	MANIFOLD: bool = false,
	90	ENUM_ARCHIVED: bool = false,
	91	UPDATE_KEYID: bool = false,
	92	BACKUP_RESTORE: bool = false,
	93	MAXIMUM_ALLOWED: bool = false,
	94	CREATE_NEW: bool = false,
	95	OPEN_EXISTING: bool = false,
	96	READONLY: bool = false,
	97	Reserved16: u16 = 0,
	98	};
	99
	100	pub const ADD = enum(DWORD) {
	101	NEW = 1,
	102	USE_EXISTING = 2,
	103	REPLACE_EXISTING = 3,
	104	ALWAYS = 4,
	105	REPLACE_EXISTING_INHERIT_PROPERTIES = 5,
	106	REWER = 6,
	107	NEWER_INHERIT_PROPERTIES = 7,
	108	_,
	109	};
	110	};
	111
	112	pub extern "crypt32" fn CertOpenStore(
	113	lpszStoreProvider: CERT_STORE.PROV,
	114	dwEncodingType: ENCODING.TYPE,
	115	hCryptProv: HCRYPTPROV_LEGACY,
	116	dwFlags: CERT_STORE.FLAG,
	117	pvPara: ?*const anyopaque,
21	118	) callconv(.winapi) ?HCERTSTORE;
22	119
	120	pub const CERT_CLOSE_STORE_FLAG = packed struct(DWORD) {
	121	FORCE: bool = false,
	122	CHECK: bool = false,
	123	Reserved2: u30 = 0,
	124	};
	125
23	126	pub extern "crypt32" fn CertCloseStore(
24	127	hCertStore: HCERTSTORE,
25		dwFlags: DWORD,
	128	dwFlags: CERT_CLOSE_STORE_FLAG,
26	129	) callconv(.winapi) BOOL;
27	130
28	131	pub extern "crypt32" fn CertEnumCertificatesInStore(
29	132	hCertStore: HCERTSTORE,
30	133	pPrevCertContext: ?*CERT_CONTEXT,
31	134	) callconv(.winapi) ?*CERT_CONTEXT;
	135
	136	pub extern "crypt32" fn CertFreeCertificateContext(
	137	pCertContext: ?*const CERT_CONTEXT,
	138	) callconv(.winapi) BOOL;
	139
	140	pub extern "crypt32" fn CertAddEncodedCertificateToStore(
	141	hCertStore: ?HCERTSTORE,
	142	dwCertEncodingType: ENCODING.TYPE,
	143	pbCertEncoded: [*]const BYTE,
	144	cbCertEncoded: DWORD,
	145	dwAddDisposition: CERT_STORE.ADD,
	146	ppCertContext: ??const CERT_CONTEXT,
	147	) callconv(.winapi) BOOL;
	148
	149	pub extern "crypt32" fn CertOpenSystemStoreW(
	150	hProv: HCRYPTPROV_LEGACY,
	151	szSubsystemProtocol: LPCWSTR,
	152	) callconv(.winapi) ?HCERTSTORE;
	153
	154	pub const HCERTCHAINENGINE = enum(usize) {
	155	CURRENT_USER = 0x0,
	156	LOCAL_MACHINE = 0x1,
	157	SERIAL_LOCAL_MACHINE = 0x2,
	158	/// HANDLE
	159	_,
	160
	161	pub fn fromHandle(handle: HANDLE) HCERTCHAINENGINE {
	162	return @enumFromInt(@intFromPtr(handle));
	163	}
	164	};
	165
	166	pub const CERT_CHAIN = packed struct(DWORD) {
	167	CACHE_END_CERT: bool = false,
	168	THREAD_STORE_SYNC: bool = false,
	169	CACHE_ONLY_URL_RETRIEVAL: bool = false,
	170	USE_LOCAL_MACHINE_STORE: bool = false,
	171	ENABLE_CACHE_AUTO_UPDATE: bool = false,
	172	ENABLE_SHARE_STORE: bool = false,
	173	Reserved6: u20 = 0,
	174	REVOCATION_CHECK_OCSP_CERT: bool = false,
	175	REVOCATION_ACCUMULATIVE_TIMEOUT: bool = false,
	176	REVOCATION_CHECK_END_CERT: bool = false,
	177	REVOCATION_CHECK_CHAIN: bool = false,
	178	REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT: bool = false,
	179	REVOCATION_CHECK_CACHE_ONLY: bool = false,
	180
	181	pub const CONTEXT = opaque {};
	182
	183	pub const USAGE_MATCH = extern struct {
	184	dwType: TYPE,
	185	Usage: CERT_ENHKEY_USAGE,
	186
	187	pub const TYPE = enum(DWORD) { AND = 0x00000000, OR = 0x00000001, _ };
	188	};
	189
	190	pub const PARA = extern struct {
	191	cbSize: DWORD = @sizeOf(PARA),
	192	RequestedUsage: USAGE_MATCH,
	193	};
	194
	195	pub const POLICY = enum(usize) {
	196	BASE = 1,
	197	AUTHENTICODE = 2,
	198	AUTHENTICODE_TS = 3,
	199	SSL = 4,
	200	BASIC_CONSTRAINTS = 5,
	201	NT_AUTH = 6,
	202	MICROSOFT_ROOT = 7,
	203	EV = 8,
	204	SSL_F12 = 9,
	205	SSL_HPKP_HEADER = 10,
	206	THIRD_PARTY_ROOT = 11,
	207	SSL_KEY_PIN = 12,
	208	CT = 13,
	209	/// LPCSTR
	210	_,
	211
	212	pub fn fromString(str: LPCSTR) POLICY {
	213	return @enumFromInt(@intFromPtr(str));
	214	}
	215
	216	pub const PARA = extern struct {
	217	cbSize: DWORD = @sizeOf(POLICY.PARA),
	218	dwFlags: FLAG,
	219	pvExtraPolicyPara: ?*anyopaque,
	220	};
	221
	222	pub const STATUS = extern struct {
	223	cbSize: DWORD = @sizeOf(STATUS),
	224	dwError: windows.Win32Error,
	225	lChainIndex: LONG,
	226	lElementIndex: LONG,
	227	pvExtraPolicyStatus: ?*anyopaque,
	228	};
	229
	230	pub const FLAG = packed struct(DWORD) {
	231	IGNORE_NOT_TIME_VALID: bool = false,
	232	IGNORE_CTL_NOT_TIME_VALID: bool = false,
	233	IGNORE_NOT_TIME_NESTED: bool = false,
	234	IGNORE_INVALID_BASIC_CONSTRAINTS: bool = false,
	235	ALLOW_UNKNOWN_CA: bool = false,
	236	IGNORE_WRONG_USAGE: bool = false,
	237	IGNORE_INVALID_NAME: bool = false,
	238	IGNORE_INVALID_POLICY: bool = false,
	239	IGNORE_END_REV_UNKNOWN: bool = false,
	240	IGNORE_CTL_SIGNER_REV_UNKNOWN: bool = false,
	241	IGNORE_CA_REV_UNKNOWN: bool = false,
	242	IGNORE_ROOT_REV_UNKNOWN: bool = false,
	243	IGNORE_PEER_TRUST: bool = false,
	244	IGNORE_NOT_SUPPORTED_CRITICAL_EXT: bool = false,
	245	TRUST_TESTROOT: bool = false,
	246	ALLOW_TESTROOT: bool = false,
	247	Reserved16: u11 = 0,
	248	IGNORE_WEAK_SIGNATURE: bool = false,
	249	Reserved28: u4 = 0,
	250	};
	251	};
	252	};
	253
	254	pub const HTTPSPolicyCallbackData = extern struct {
	255	cbSize: DWORD = @sizeOf(HTTPSPolicyCallbackData),
	256	dwAuthType: AUTHTYPE,
	257	fdwChecks: DWORD = 0,
	258	pwszServerName: ?LPCWSTR = null,
	259
	260	pub const AUTHTYPE = enum(DWORD) { CLIENT = 1, SERVER = 2, _ };
	261	};
	262
	263	pub extern "crypt32" fn CertGetCertificateChain(
	264	hChainEngine: HCERTCHAINENGINE,
	265	pCertContext: *const CERT_CONTEXT,
	266	pTime: ?*const FILETIME,
	267	hAdditionalStore: ?HCERTSTORE,
	268	pChainPara: *const CERT_CHAIN.PARA,
	269	dwFlags: CERT_CHAIN,
	270	pvReserved: ?*const anyopaque,
	271	ppChainContext: **const CERT_CHAIN.CONTEXT,
	272	) callconv(.winapi) BOOL;
	273
	274	pub extern "crypt32" fn CertFreeCertificateChain(
	275	pChainContext: *const CERT_CHAIN.CONTEXT,
	276	) callconv(.winapi) void;
	277
	278	pub extern "crypt32" fn CertVerifyCertificateChainPolicy(
	279	pszPolicyOID: CERT_CHAIN.POLICY,
	280	pChainContext: *const CERT_CHAIN.CONTEXT,
	281	pPolicyPara: *const CERT_CHAIN.POLICY.PARA,
	282	pPolicyStatus: *CERT_CHAIN.POLICY.STATUS,
	283	) callconv(.winapi) BOOL;

lib/std/os/windows/win32error.zig+417-134

...	...	@@ -2503,271 +2503,554 @@ pub const Win32Error = enum(u32) {
2503	2503	REQUEST_PAUSED = 3050,
2504	2504	/// Reissue the given operation as a cached IO operation.
2505	2505	IO_REISSUE_AS_CACHED = 3950,
	2506
2506	2507	/// DNS server unable to interpret format.
2507		DNS_FORMAT_ERROR = 9001,
	2508	DNS_ERROR_RCODE_FORMAT_ERROR = 9001,
2508	2509	/// DNS server failure.
2509		DNS_SERVER_FAILURE = 9002,
	2510	DNS_ERROR_RCODE_SERVER_FAILURE = 9002,
2510	2511	/// DNS name does not exist.
2511		DNS_NAME_ERROR = 9003,
	2512	DNS_ERROR_RCODE_NAME_ERROR = 9003,
2512	2513	/// DNS request not supported by name server.
2513		DNS_NOT_IMPLEMENTED = 9004,
	2514	DNS_ERROR_RCODE_NOT_IMPLEMENTED = 9004,
2514	2515	/// DNS operation refused.
2515		DNS_REFUSED = 9005,
	2516	DNS_ERROR_RCODE_REFUSED = 9005,
2516	2517	/// DNS name that ought not exist, does exist.
2517		DNS_YXDOMAIN = 9006,
	2518	DNS_ERROR_RCODE_YXDOMAIN = 9006,
2518	2519	/// DNS RR set that ought not exist, does exist.
2519		DNS_YXRRSET = 9007,
	2520	DNS_ERROR_RCODE_YXRRSET = 9007,
2520	2521	/// DNS RR set that ought to exist, does not exist.
2521		DNS_NXRRSET = 9008,
	2522	DNS_ERROR_RCODE_NXRRSET = 9008,
2522	2523	/// DNS server not authoritative for zone.
2523		DNS_NOTAUTH = 9009,
	2524	DNS_ERROR_RCODE_NOTAUTH = 9009,
2524	2525	/// DNS name in update or prereq is not in zone.
2525		DNS_NOTZONE = 9010,
	2526	DNS_ERROR_RCODE_NOTZONE = 9010,
2526	2527	/// DNS signature failed to verify.
2527		DNS_BADSIG = 9016,
	2528	DNS_ERROR_RCODE_BADSIG = 9016,
2528	2529	/// DNS bad key.
2529		DNS_BADKEY = 9017,
	2530	DNS_ERROR_RCODE_BADKEY = 9017,
2530	2531	/// DNS signature validity expired.
2531		DNS_BADTIME = 9018,
	2532	DNS_ERROR_RCODE_BADTIME = 9018,
	2533	/// DNSSEC errors
	2534	DNS_ERROR_DNSSEC_BASE = 9100,
2532	2535	/// Only the DNS server acting as the key master for the zone may perform this operation.
2533		DNS_KEYMASTER_REQUIRED = 9101,
	2536	DNS_ERROR_KEYMASTER_REQUIRED = 9101,
2534	2537	/// This operation is not allowed on a zone that is signed or has signing keys.
2535		DNS_NOT_ALLOWED_ON_SIGNED_ZONE = 9102,
	2538	DNS_ERROR_NOT_ALLOWED_ON_SIGNED_ZONE = 9102,
2536	2539	/// NSEC3 is not compatible with the RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC.
2537		///
2538		/// This value was also named DNS_INVALID_NSEC3_PARAMETERS
2539		DNS_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 = 9103,
	2540	DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 = 9103,
2540	2541	/// The zone does not have enough signing keys. There must be at least one key signing key (KSK) and at least one zone signing key (ZSK).
2541		DNS_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS = 9104,
	2542	DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS = 9104,
2542	2543	/// The specified algorithm is not supported.
2543		DNS_UNSUPPORTED_ALGORITHM = 9105,
	2544	DNS_ERROR_UNSUPPORTED_ALGORITHM = 9105,
2544	2545	/// The specified key size is not supported.
2545		DNS_INVALID_KEY_SIZE = 9106,
	2546	DNS_ERROR_INVALID_KEY_SIZE = 9106,
2546	2547	/// One or more of the signing keys for a zone are not accessible to the DNS server. Zone signing will not be operational until this error is resolved.
2547		DNS_SIGNING_KEY_NOT_ACCESSIBLE = 9107,
	2548	DNS_ERROR_SIGNING_KEY_NOT_ACCESSIBLE = 9107,
2548	2549	/// The specified key storage provider does not support DPAPI++ data protection. Zone signing will not be operational until this error is resolved.
2549		DNS_KSP_DOES_NOT_SUPPORT_PROTECTION = 9108,
	2550	DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION = 9108,
2550	2551	/// An unexpected DPAPI++ error was encountered. Zone signing will not be operational until this error is resolved.
2551		DNS_UNEXPECTED_DATA_PROTECTION_ERROR = 9109,
	2552	DNS_ERROR_UNEXPECTED_DATA_PROTECTION_ERROR = 9109,
2552	2553	/// An unexpected crypto error was encountered. Zone signing may not be operational until this error is resolved.
2553		DNS_UNEXPECTED_CNG_ERROR = 9110,
	2554	DNS_ERROR_UNEXPECTED_CNG_ERROR = 9110,
2554	2555	/// The DNS server encountered a signing key with an unknown version. Zone signing will not be operational until this error is resolved.
2555		DNS_UNKNOWN_SIGNING_PARAMETER_VERSION = 9111,
	2556	DNS_ERROR_UNKNOWN_SIGNING_PARAMETER_VERSION = 9111,
2556	2557	/// The specified key service provider cannot be opened by the DNS server.
2557		DNS_KSP_NOT_ACCESSIBLE = 9112,
	2558	DNS_ERROR_KSP_NOT_ACCESSIBLE = 9112,
2558	2559	/// The DNS server cannot accept any more signing keys with the specified algorithm and KSK flag value for this zone.
2559		DNS_TOO_MANY_SKDS = 9113,
	2560	DNS_ERROR_TOO_MANY_SKDS = 9113,
2560	2561	/// The specified rollover period is invalid.
2561		DNS_INVALID_ROLLOVER_PERIOD = 9114,
	2562	DNS_ERROR_INVALID_ROLLOVER_PERIOD = 9114,
2562	2563	/// The specified initial rollover offset is invalid.
2563		DNS_INVALID_INITIAL_ROLLOVER_OFFSET = 9115,
	2564	DNS_ERROR_INVALID_INITIAL_ROLLOVER_OFFSET = 9115,
2564	2565	/// The specified signing key is already in process of rolling over keys.
2565		DNS_ROLLOVER_IN_PROGRESS = 9116,
	2566	DNS_ERROR_ROLLOVER_IN_PROGRESS = 9116,
2566	2567	/// The specified signing key does not have a standby key to revoke.
2567		DNS_STANDBY_KEY_NOT_PRESENT = 9117,
	2568	DNS_ERROR_STANDBY_KEY_NOT_PRESENT = 9117,
2568	2569	/// This operation is not allowed on a zone signing key (ZSK).
2569		DNS_NOT_ALLOWED_ON_ZSK = 9118,
	2570	DNS_ERROR_NOT_ALLOWED_ON_ZSK = 9118,
2570	2571	/// This operation is not allowed on an active signing key.
2571		DNS_NOT_ALLOWED_ON_ACTIVE_SKD = 9119,
	2572	DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD = 9119,
2572	2573	/// The specified signing key is already queued for rollover.
2573		DNS_ROLLOVER_ALREADY_QUEUED = 9120,
	2574	DNS_ERROR_ROLLOVER_ALREADY_QUEUED = 9120,
2574	2575	/// This operation is not allowed on an unsigned zone.
2575		DNS_NOT_ALLOWED_ON_UNSIGNED_ZONE = 9121,
	2576	DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE = 9121,
2576	2577	/// This operation could not be completed because the DNS server listed as the current key master for this zone is down or misconfigured. Resolve the problem on the current key master for this zone or use another DNS server to seize the key master role.
2577		DNS_BAD_KEYMASTER = 9122,
	2578	DNS_ERROR_BAD_KEYMASTER = 9122,
2578	2579	/// The specified signature validity period is invalid.
2579		DNS_INVALID_SIGNATURE_VALIDITY_PERIOD = 9123,
	2580	DNS_ERROR_INVALID_SIGNATURE_VALIDITY_PERIOD = 9123,
2580	2581	/// The specified NSEC3 iteration count is higher than allowed by the minimum key length used in the zone.
2581		DNS_INVALID_NSEC3_ITERATION_COUNT = 9124,
	2582	DNS_ERROR_INVALID_NSEC3_ITERATION_COUNT = 9124,
2582	2583	/// This operation could not be completed because the DNS server has been configured with DNSSEC features disabled. Enable DNSSEC on the DNS server.
2583		DNS_DNSSEC_IS_DISABLED = 9125,
	2584	DNS_ERROR_DNSSEC_IS_DISABLED = 9125,
2584	2585	/// This operation could not be completed because the XML stream received is empty or syntactically invalid.
2585		DNS_INVALID_XML = 9126,
	2586	DNS_ERROR_INVALID_XML = 9126,
2586	2587	/// This operation completed, but no trust anchors were added because all of the trust anchors received were either invalid, unsupported, expired, or would not become valid in less than 30 days.
2587		DNS_NO_VALID_TRUST_ANCHORS = 9127,
	2588	DNS_ERROR_NO_VALID_TRUST_ANCHORS = 9127,
2588	2589	/// The specified signing key is not waiting for parental DS update.
2589		DNS_ROLLOVER_NOT_POKEABLE = 9128,
	2590	DNS_ERROR_ROLLOVER_NOT_POKEABLE = 9128,
2590	2591	/// Hash collision detected during NSEC3 signing. Specify a different user-provided salt, or use a randomly generated salt, and attempt to sign the zone again.
2591		DNS_NSEC3_NAME_COLLISION = 9129,
	2592	DNS_ERROR_NSEC3_NAME_COLLISION = 9129,
2592	2593	/// NSEC is not compatible with the NSEC3-RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC3.
2593		DNS_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1 = 9130,
	2594	DNS_ERROR_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1 = 9130,
	2595	/// Packet format
	2596	DNS_ERROR_PACKET_FMT_BASE = 9500,
2594	2597	/// No records found for given DNS query.
2595		DNS_NO_RECORDS = 9501,
	2598	DNS_INFO_NO_RECORDS = 9501,
2596	2599	/// Bad DNS packet.
2597		DNS_BAD_PACKET = 9502,
	2600	DNS_ERROR_BAD_PACKET = 9502,
2598	2601	/// No DNS packet.
2599		DNS_NO_PACKET = 9503,
	2602	DNS_ERROR_NO_PACKET = 9503,
2600	2603	/// DNS error, check rcode.
2601		DNS_RCODE = 9504,
	2604	DNS_ERROR_RCODE = 9504,
2602	2605	/// Unsecured DNS packet.
2603		DNS_UNSECURE_PACKET = 9505,
	2606	DNS_ERROR_UNSECURE_PACKET = 9505,
2604	2607	/// DNS query request is pending.
2605	2608	DNS_REQUEST_PENDING = 9506,
2606	2609	/// Invalid DNS type.
2607		DNS_INVALID_TYPE = 9551,
	2610	DNS_ERROR_INVALID_TYPE = 9551,
2608	2611	/// Invalid IP address.
2609		DNS_INVALID_IP_ADDRESS = 9552,
	2612	DNS_ERROR_INVALID_IP_ADDRESS = 9552,
2610	2613	/// Invalid property.
2611		DNS_INVALID_PROPERTY = 9553,
	2614	DNS_ERROR_INVALID_PROPERTY = 9553,
2612	2615	/// Try DNS operation again later.
2613		DNS_TRY_AGAIN_LATER = 9554,
	2616	DNS_ERROR_TRY_AGAIN_LATER = 9554,
2614	2617	/// Record for given name and type is not unique.
2615		DNS_NOT_UNIQUE = 9555,
	2618	DNS_ERROR_NOT_UNIQUE = 9555,
2616	2619	/// DNS name does not comply with RFC specifications.
2617		DNS_NON_RFC_NAME = 9556,
	2620	DNS_ERROR_NON_RFC_NAME = 9556,
2618	2621	/// DNS name is a fully-qualified DNS name.
2619		DNS_FQDN = 9557,
	2622	DNS_STATUS_FQDN = 9557,
2620	2623	/// DNS name is dotted (multi-label).
2621		DNS_DOTTED_NAME = 9558,
	2624	DNS_STATUS_DOTTED_NAME = 9558,
2622	2625	/// DNS name is a single-part name.
2623		DNS_SINGLE_PART_NAME = 9559,
	2626	DNS_STATUS_SINGLE_PART_NAME = 9559,
2624	2627	/// DNS name contains an invalid character.
2625		DNS_INVALID_NAME_CHAR = 9560,
	2628	DNS_ERROR_INVALID_NAME_CHAR = 9560,
2626	2629	/// DNS name is entirely numeric.
2627		DNS_NUMERIC_NAME = 9561,
	2630	DNS_ERROR_NUMERIC_NAME = 9561,
2628	2631	/// The operation requested is not permitted on a DNS root server.
2629		DNS_NOT_ALLOWED_ON_ROOT_SERVER = 9562,
	2632	DNS_ERROR_NOT_ALLOWED_ON_ROOT_SERVER = 9562,
2630	2633	/// The record could not be created because this part of the DNS namespace has been delegated to another server.
2631		DNS_NOT_ALLOWED_UNDER_DELEGATION = 9563,
	2634	DNS_ERROR_NOT_ALLOWED_UNDER_DELEGATION = 9563,
2632	2635	/// The DNS server could not find a set of root hints.
2633		DNS_CANNOT_FIND_ROOT_HINTS = 9564,
	2636	DNS_ERROR_CANNOT_FIND_ROOT_HINTS = 9564,
2634	2637	/// The DNS server found root hints but they were not consistent across all adapters.
2635		DNS_INCONSISTENT_ROOT_HINTS = 9565,
	2638	DNS_ERROR_INCONSISTENT_ROOT_HINTS = 9565,
2636	2639	/// The specified value is too small for this parameter.
2637		DNS_DWORD_VALUE_TOO_SMALL = 9566,
	2640	DNS_ERROR_DWORD_VALUE_TOO_SMALL = 9566,
2638	2641	/// The specified value is too large for this parameter.
2639		DNS_DWORD_VALUE_TOO_LARGE = 9567,
	2642	DNS_ERROR_DWORD_VALUE_TOO_LARGE = 9567,
2640	2643	/// This operation is not allowed while the DNS server is loading zones in the background. Please try again later.
2641		DNS_BACKGROUND_LOADING = 9568,
	2644	DNS_ERROR_BACKGROUND_LOADING = 9568,
2642	2645	/// The operation requested is not permitted on against a DNS server running on a read-only DC.
2643		DNS_NOT_ALLOWED_ON_RODC = 9569,
	2646	DNS_ERROR_NOT_ALLOWED_ON_RODC = 9569,
2644	2647	/// No data is allowed to exist underneath a DNAME record.
2645		DNS_NOT_ALLOWED_UNDER_DNAME = 9570,
	2648	DNS_ERROR_NOT_ALLOWED_UNDER_DNAME = 9570,
2646	2649	/// This operation requires credentials delegation.
2647		DNS_DELEGATION_REQUIRED = 9571,
	2650	DNS_ERROR_DELEGATION_REQUIRED = 9571,
2648	2651	/// Name resolution policy table has been corrupted. DNS resolution will fail until it is fixed. Contact your network administrator.
2649		DNS_INVALID_POLICY_TABLE = 9572,
	2652	DNS_ERROR_INVALID_POLICY_TABLE = 9572,
	2653	/// Not allowed to remove all addresses.
	2654	DNS_ERROR_ADDRESS_REQUIRED = 9573,
	2655	/// Zone errors
	2656	DNS_ERROR_ZONE_BASE = 9600,
2650	2657	/// DNS zone does not exist.
2651		DNS_ZONE_DOES_NOT_EXIST = 9601,
	2658	DNS_ERROR_ZONE_DOES_NOT_EXIST = 9601,
2652	2659	/// DNS zone information not available.
2653		DNS_NO_ZONE_INFO = 9602,
	2660	DNS_ERROR_NO_ZONE_INFO = 9602,
2654	2661	/// Invalid operation for DNS zone.
2655		DNS_INVALID_ZONE_OPERATION = 9603,
	2662	DNS_ERROR_INVALID_ZONE_OPERATION = 9603,
2656	2663	/// Invalid DNS zone configuration.
2657		DNS_ZONE_CONFIGURATION_ERROR = 9604,
	2664	DNS_ERROR_ZONE_CONFIGURATION_ERROR = 9604,
2658	2665	/// DNS zone has no start of authority (SOA) record.
2659		DNS_ZONE_HAS_NO_SOA_RECORD = 9605,
	2666	DNS_ERROR_ZONE_HAS_NO_SOA_RECORD = 9605,
2660	2667	/// DNS zone has no Name Server (NS) record.
2661		DNS_ZONE_HAS_NO_NS_RECORDS = 9606,
	2668	DNS_ERROR_ZONE_HAS_NO_NS_RECORDS = 9606,
2662	2669	/// DNS zone is locked.
2663		DNS_ZONE_LOCKED = 9607,
	2670	DNS_ERROR_ZONE_LOCKED = 9607,
2664	2671	/// DNS zone creation failed.
2665		DNS_ZONE_CREATION_FAILED = 9608,
	2672	DNS_ERROR_ZONE_CREATION_FAILED = 9608,
2666	2673	/// DNS zone already exists.
2667		DNS_ZONE_ALREADY_EXISTS = 9609,
	2674	DNS_ERROR_ZONE_ALREADY_EXISTS = 9609,
2668	2675	/// DNS automatic zone already exists.
2669		DNS_AUTOZONE_ALREADY_EXISTS = 9610,
	2676	DNS_ERROR_AUTOZONE_ALREADY_EXISTS = 9610,
2670	2677	/// Invalid DNS zone type.
2671		DNS_INVALID_ZONE_TYPE = 9611,
	2678	DNS_ERROR_INVALID_ZONE_TYPE = 9611,
2672	2679	/// Secondary DNS zone requires master IP address.
2673		DNS_SECONDARY_REQUIRES_MASTER_IP = 9612,
	2680	DNS_ERROR_SECONDARY_REQUIRES_MASTER_IP = 9612,
2674	2681	/// DNS zone not secondary.
2675		DNS_ZONE_NOT_SECONDARY = 9613,
	2682	DNS_ERROR_ZONE_NOT_SECONDARY = 9613,
2676	2683	/// Need secondary IP address.
2677		DNS_NEED_SECONDARY_ADDRESSES = 9614,
	2684	DNS_ERROR_NEED_SECONDARY_ADDRESSES = 9614,
2678	2685	/// WINS initialization failed.
2679		DNS_WINS_INIT_FAILED = 9615,
	2686	DNS_ERROR_WINS_INIT_FAILED = 9615,
2680	2687	/// Need WINS servers.
2681		DNS_NEED_WINS_SERVERS = 9616,
	2688	DNS_ERROR_NEED_WINS_SERVERS = 9616,
2682	2689	/// NBTSTAT initialization call failed.
2683		DNS_NBSTAT_INIT_FAILED = 9617,
2684		/// Invalid delete of start of authority (SOA).
2685		DNS_SOA_DELETE_INVALID = 9618,
	2690	DNS_ERROR_NBSTAT_INIT_FAILED = 9617,
	2691	/// Invalid delete of start of authority (SOA)
	2692	DNS_ERROR_SOA_DELETE_INVALID = 9618,
2686	2693	/// A conditional forwarding zone already exists for that name.
2687		DNS_FORWARDER_ALREADY_EXISTS = 9619,
	2694	DNS_ERROR_FORWARDER_ALREADY_EXISTS = 9619,
2688	2695	/// This zone must be configured with one or more master DNS server IP addresses.
2689		DNS_ZONE_REQUIRES_MASTER_IP = 9620,
	2696	DNS_ERROR_ZONE_REQUIRES_MASTER_IP = 9620,
2690	2697	/// The operation cannot be performed because this zone is shut down.
2691		DNS_ZONE_IS_SHUTDOWN = 9621,
	2698	DNS_ERROR_ZONE_IS_SHUTDOWN = 9621,
2692	2699	/// This operation cannot be performed because the zone is currently being signed. Please try again later.
2693		DNS_ZONE_LOCKED_FOR_SIGNING = 9622,
	2700	DNS_ERROR_ZONE_LOCKED_FOR_SIGNING = 9622,
	2701	/// Datafile errors
	2702	DNS_ERROR_DATAFILE_BASE = 9650,
	2703	/// DNS 0x000025b3
2694	2704	/// Primary DNS zone requires datafile.
2695		DNS_PRIMARY_REQUIRES_DATAFILE = 9651,
	2705	DNS_ERROR_PRIMARY_REQUIRES_DATAFILE = 9651,
	2706	/// DNS 0x000025b4
2696	2707	/// Invalid datafile name for DNS zone.
2697		DNS_INVALID_DATAFILE_NAME = 9652,
	2708	DNS_ERROR_INVALID_DATAFILE_NAME = 9652,
	2709	/// DNS 0x000025b5
2698	2710	/// Failed to open datafile for DNS zone.
2699		DNS_DATAFILE_OPEN_FAILURE = 9653,
	2711	DNS_ERROR_DATAFILE_OPEN_FAILURE = 9653,
	2712	/// DNS 0x000025b6
2700	2713	/// Failed to write datafile for DNS zone.
2701		DNS_FILE_WRITEBACK_FAILED = 9654,
	2714	DNS_ERROR_FILE_WRITEBACK_FAILED = 9654,
	2715	/// DNS 0x000025b7
2702	2716	/// Failure while reading datafile for DNS zone.
2703		DNS_DATAFILE_PARSING = 9655,
	2717	DNS_ERROR_DATAFILE_PARSING = 9655,
	2718	/// Database errors
	2719	DNS_ERROR_DATABASE_BASE = 9700,
2704	2720	/// DNS record does not exist.
2705		DNS_RECORD_DOES_NOT_EXIST = 9701,
	2721	DNS_ERROR_RECORD_DOES_NOT_EXIST = 9701,
2706	2722	/// DNS record format error.
2707		DNS_RECORD_FORMAT = 9702,
	2723	DNS_ERROR_RECORD_FORMAT = 9702,
2708	2724	/// Node creation failure in DNS.
2709		DNS_NODE_CREATION_FAILED = 9703,
	2725	DNS_ERROR_NODE_CREATION_FAILED = 9703,
2710	2726	/// Unknown DNS record type.
2711		DNS_UNKNOWN_RECORD_TYPE = 9704,
	2727	DNS_ERROR_UNKNOWN_RECORD_TYPE = 9704,
2712	2728	/// DNS record timed out.
2713		DNS_RECORD_TIMED_OUT = 9705,
	2729	DNS_ERROR_RECORD_TIMED_OUT = 9705,
2714	2730	/// Name not in DNS zone.
2715		DNS_NAME_NOT_IN_ZONE = 9706,
	2731	DNS_ERROR_NAME_NOT_IN_ZONE = 9706,
2716	2732	/// CNAME loop detected.
2717		DNS_CNAME_LOOP = 9707,
	2733	DNS_ERROR_CNAME_LOOP = 9707,
2718	2734	/// Node is a CNAME DNS record.
2719		DNS_NODE_IS_CNAME = 9708,
	2735	DNS_ERROR_NODE_IS_CNAME = 9708,
2720	2736	/// A CNAME record already exists for given name.
2721		DNS_CNAME_COLLISION = 9709,
	2737	DNS_ERROR_CNAME_COLLISION = 9709,
2722	2738	/// Record only at DNS zone root.
2723		DNS_RECORD_ONLY_AT_ZONE_ROOT = 9710,
	2739	DNS_ERROR_RECORD_ONLY_AT_ZONE_ROOT = 9710,
2724	2740	/// DNS record already exists.
2725		DNS_RECORD_ALREADY_EXISTS = 9711,
	2741	DNS_ERROR_RECORD_ALREADY_EXISTS = 9711,
2726	2742	/// Secondary DNS zone data error.
2727		DNS_SECONDARY_DATA = 9712,
	2743	DNS_ERROR_SECONDARY_DATA = 9712,
2728	2744	/// Could not create DNS cache data.
2729		DNS_NO_CREATE_CACHE_DATA = 9713,
	2745	DNS_ERROR_NO_CREATE_CACHE_DATA = 9713,
2730	2746	/// DNS name does not exist.
2731		DNS_NAME_DOES_NOT_EXIST = 9714,
	2747	DNS_ERROR_NAME_DOES_NOT_EXIST = 9714,
2732	2748	/// Could not create pointer (PTR) record.
2733		DNS_PTR_CREATE_FAILED = 9715,
	2749	DNS_WARNING_PTR_CREATE_FAILED = 9715,
2734	2750	/// DNS domain was undeleted.
2735		DNS_DOMAIN_UNDELETED = 9716,
	2751	DNS_WARNING_DOMAIN_UNDELETED = 9716,
2736	2752	/// The directory service is unavailable.
2737		DNS_DS_UNAVAILABLE = 9717,
	2753	DNS_ERROR_DS_UNAVAILABLE = 9717,
2738	2754	/// DNS zone already exists in the directory service.
2739		DNS_DS_ZONE_ALREADY_EXISTS = 9718,
	2755	DNS_ERROR_DS_ZONE_ALREADY_EXISTS = 9718,
2740	2756	/// DNS server not creating or reading the boot file for the directory service integrated DNS zone.
2741		DNS_NO_BOOTFILE_IF_DS_ZONE = 9719,
	2757	DNS_ERROR_NO_BOOTFILE_IF_DS_ZONE = 9719,
2742	2758	/// Node is a DNAME DNS record.
2743		DNS_NODE_IS_DNAME = 9720,
	2759	DNS_ERROR_NODE_IS_DNAME = 9720,
2744	2760	/// A DNAME record already exists for given name.
2745		DNS_DNAME_COLLISION = 9721,
	2761	DNS_ERROR_DNAME_COLLISION = 9721,
2746	2762	/// An alias loop has been detected with either CNAME or DNAME records.
2747		DNS_ALIAS_LOOP = 9722,
	2763	DNS_ERROR_ALIAS_LOOP = 9722,
	2764	/// Operation errors
	2765	DNS_ERROR_OPERATION_BASE = 9750,
2748	2766	/// DNS AXFR (zone transfer) complete.
2749		DNS_AXFR_COMPLETE = 9751,
	2767	DNS_INFO_AXFR_COMPLETE = 9751,
2750	2768	/// DNS zone transfer failed.
2751		DNS_AXFR = 9752,
	2769	DNS_ERROR_AXFR = 9752,
2752	2770	/// Added local WINS server.
2753		DNS_ADDED_LOCAL_WINS = 9753,
	2771	DNS_INFO_ADDED_LOCAL_WINS = 9753,
	2772	/// Secure update
	2773	DNS_ERROR_SECURE_BASE = 9800,
2754	2774	/// Secure update call needs to continue update request.
2755		DNS_CONTINUE_NEEDED = 9801,
	2775	DNS_STATUS_CONTINUE_NEEDED = 9801,
	2776	/// Setup errors
	2777	DNS_ERROR_SETUP_BASE = 9850,
2756	2778	/// TCP/IP network protocol not installed.
2757		DNS_NO_TCPIP = 9851,
	2779	DNS_ERROR_NO_TCPIP = 9851,
2758	2780	/// No DNS servers configured for local system.
2759		DNS_NO_DNS_SERVERS = 9852,
	2781	DNS_ERROR_NO_DNS_SERVERS = 9852,
	2782	/// Directory partition (DP) errors
	2783	DNS_ERROR_DP_BASE = 9900,
2760	2784	/// The specified directory partition does not exist.
2761		DNS_DP_DOES_NOT_EXIST = 9901,
	2785	DNS_ERROR_DP_DOES_NOT_EXIST = 9901,
2762	2786	/// The specified directory partition already exists.
2763		DNS_DP_ALREADY_EXISTS = 9902,
	2787	DNS_ERROR_DP_ALREADY_EXISTS = 9902,
2764	2788	/// This DNS server is not enlisted in the specified directory partition.
2765		DNS_DP_NOT_ENLISTED = 9903,
	2789	DNS_ERROR_DP_NOT_ENLISTED = 9903,
2766	2790	/// This DNS server is already enlisted in the specified directory partition.
2767		DNS_DP_ALREADY_ENLISTED = 9904,
	2791	DNS_ERROR_DP_ALREADY_ENLISTED = 9904,
2768	2792	/// The directory partition is not available at this time. Please wait a few minutes and try again.
2769		DNS_DP_NOT_AVAILABLE = 9905,
	2793	DNS_ERROR_DP_NOT_AVAILABLE = 9905,
2770	2794	/// The operation failed because the domain naming master FSMO role could not be reached. The domain controller holding the domain naming master FSMO role is down or unable to service the request or is not running Windows Server 2003 or later.
2771		DNS_DP_FSMO_ERROR = 9906,
	2795	DNS_ERROR_DP_FSMO_ERROR = 9906,
	2796	/// DNS RRL errors from 9911 to 9920
	2797	/// The RRL is not enabled.
	2798	DNS_ERROR_RRL_NOT_ENABLED = 9911,
	2799	/// The window size parameter is invalid. It should be greater than or equal to 1.
	2800	DNS_ERROR_RRL_INVALID_WINDOW_SIZE = 9912,
	2801	/// The IPv4 prefix length parameter is invalid. It should be less than or equal to 32.
	2802	DNS_ERROR_RRL_INVALID_IPV4_PREFIX = 9913,
	2803	/// The IPv6 prefix length parameter is invalid. It should be less than or equal to 128.
	2804	DNS_ERROR_RRL_INVALID_IPV6_PREFIX = 9914,
	2805	/// The TC Rate parameter is invalid. It should be less than 10.
	2806	DNS_ERROR_RRL_INVALID_TC_RATE = 9915,
	2807	/// The Leak Rate parameter is invalid. It should be either 0, or between 2 and 10.
	2808	DNS_ERROR_RRL_INVALID_LEAK_RATE = 9916,
	2809	/// The Leak Rate or TC Rate parameter is invalid. Leak Rate should be greater than TC Rate.
	2810	DNS_ERROR_RRL_LEAK_RATE_LESSTHAN_TC_RATE = 9917,
	2811	/// DNS Virtualization errors from 9921 to 9950
	2812	/// The virtualization instance already exists.
	2813	DNS_ERROR_VIRTUALIZATION_INSTANCE_ALREADY_EXISTS = 9921,
	2814	/// The virtualization instance does not exist.
	2815	DNS_ERROR_VIRTUALIZATION_INSTANCE_DOES_NOT_EXIST = 9922,
	2816	/// The virtualization tree is locked.
	2817	DNS_ERROR_VIRTUALIZATION_TREE_LOCKED = 9923,
	2818	/// Invalid virtualization instance name.
	2819	DNS_ERROR_INVAILD_VIRTUALIZATION_INSTANCE_NAME = 9924,
	2820	/// The default virtualization instance cannot be added, removed or modified.
	2821	DNS_ERROR_DEFAULT_VIRTUALIZATION_INSTANCE = 9925,
	2822	/// DNS ZoneScope errors from 9951 to 9970
	2823	/// The scope already exists for the zone.
	2824	DNS_ERROR_ZONESCOPE_ALREADY_EXISTS = 9951,
	2825	/// The scope does not exist for the zone.
	2826	DNS_ERROR_ZONESCOPE_DOES_NOT_EXIST = 9952,
	2827	/// The scope is the same as the default zone scope.
	2828	DNS_ERROR_DEFAULT_ZONESCOPE = 9953,
	2829	/// The scope name contains invalid characters.
	2830	DNS_ERROR_INVALID_ZONESCOPE_NAME = 9954,
	2831	/// Operation not allowed when the zone has scopes.
	2832	DNS_ERROR_NOT_ALLOWED_WITH_ZONESCOPES = 9955,
	2833	/// Failed to load zone scope.
	2834	DNS_ERROR_LOAD_ZONESCOPE_FAILED = 9956,
	2835	/// Failed to write data file for DNS zone scope. Please verify the file exists and is writable.
	2836	DNS_ERROR_ZONESCOPE_FILE_WRITEBACK_FAILED = 9957,
	2837	/// The scope name contains invalid characters.
	2838	DNS_ERROR_INVALID_SCOPE_NAME = 9958,
	2839	/// The scope does not exist.
	2840	DNS_ERROR_SCOPE_DOES_NOT_EXIST = 9959,
	2841	/// The scope is the same as the default scope.
	2842	DNS_ERROR_DEFAULT_SCOPE = 9960,
	2843	/// The operation is invalid on the scope.
	2844	DNS_ERROR_INVALID_SCOPE_OPERATION = 9961,
	2845	/// The scope is locked.
	2846	DNS_ERROR_SCOPE_LOCKED = 9962,
	2847	/// The scope already exists.
	2848	DNS_ERROR_SCOPE_ALREADY_EXISTS = 9963,
	2849	/// DNS Policy errors from 9971 to 9999
	2850	/// A policy with the same name already exists on this level (server level or zone level) on the DNS server.
	2851	DNS_ERROR_POLICY_ALREADY_EXISTS = 9971,
	2852	/// No policy with this name exists on this level (server level or zone level) on the DNS server.
	2853	DNS_ERROR_POLICY_DOES_NOT_EXIST = 9972,
	2854	/// The criteria provided in the policy are invalid.
	2855	DNS_ERROR_POLICY_INVALID_CRITERIA = 9973,
	2856	/// At least one of the settings of this policy is invalid.
	2857	DNS_ERROR_POLICY_INVALID_SETTINGS = 9974,
	2858	/// The client subnet cannot be deleted while it is being accessed by a policy.
	2859	DNS_ERROR_CLIENT_SUBNET_IS_ACCESSED = 9975,
	2860	/// The client subnet does not exist on the DNS server.
	2861	DNS_ERROR_CLIENT_SUBNET_DOES_NOT_EXIST = 9976,
	2862	/// A client subnet with this name already exists on the DNS server.
	2863	DNS_ERROR_CLIENT_SUBNET_ALREADY_EXISTS = 9977,
	2864	/// The IP subnet specified does not exist in the client subnet.
	2865	DNS_ERROR_SUBNET_DOES_NOT_EXIST = 9978,
	2866	/// The IP subnet that is being added, already exists in the client subnet.
	2867	DNS_ERROR_SUBNET_ALREADY_EXISTS = 9979,
	2868	/// The policy is locked.
	2869	DNS_ERROR_POLICY_LOCKED = 9980,
	2870	/// The weight of the scope in the policy is invalid.
	2871	DNS_ERROR_POLICY_INVALID_WEIGHT = 9981,
	2872	/// The DNS policy name is invalid.
	2873	DNS_ERROR_POLICY_INVALID_NAME = 9982,
	2874	/// The policy is missing criteria.
	2875	DNS_ERROR_POLICY_MISSING_CRITERIA = 9983,
	2876	/// The name of the the client subnet record is invalid.
	2877	DNS_ERROR_INVALID_CLIENT_SUBNET_NAME = 9984,
	2878	/// Invalid policy processing order.
	2879	DNS_ERROR_POLICY_PROCESSING_ORDER_INVALID = 9985,
	2880	/// The scope information has not been provided for a policy that requires it.
	2881	DNS_ERROR_POLICY_SCOPE_MISSING = 9986,
	2882	/// The scope information has been provided for a policy that does not require it.
	2883	DNS_ERROR_POLICY_SCOPE_NOT_ALLOWED = 9987,
	2884	/// The server scope cannot be deleted because it is referenced by a DNS Policy.
	2885	DNS_ERROR_SERVERSCOPE_IS_REFERENCED = 9988,
	2886	/// The zone scope cannot be deleted because it is referenced by a DNS Policy.
	2887	DNS_ERROR_ZONESCOPE_IS_REFERENCED = 9989,
	2888	/// The criterion client subnet provided in the policy is invalid.
	2889	DNS_ERROR_POLICY_INVALID_CRITERIA_CLIENT_SUBNET = 9990,
	2890	/// The criterion transport protocol provided in the policy is invalid.
	2891	DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL = 9991,
	2892	/// The criterion network protocol provided in the policy is invalid.
	2893	DNS_ERROR_POLICY_INVALID_CRITERIA_NETWORK_PROTOCOL = 9992,
	2894	/// The criterion interface provided in the policy is invalid.
	2895	DNS_ERROR_POLICY_INVALID_CRITERIA_INTERFACE = 9993,
	2896	/// The criterion FQDN provided in the policy is invalid.
	2897	DNS_ERROR_POLICY_INVALID_CRITERIA_FQDN = 9994,
	2898	/// The criterion query type provided in the policy is invalid.
	2899	DNS_ERROR_POLICY_INVALID_CRITERIA_QUERY_TYPE = 9995,
	2900	/// The criterion time of day provided in the policy is invalid.
	2901	DNS_ERROR_POLICY_INVALID_CRITERIA_TIME_OF_DAY = 9996,
	2902
	2903	/// An error occurred while performing an operation on a cryptographic message.
	2904	CRYPT_E_MSG_ERROR = 0x80091001,
	2905	/// Unknown cryptographic algorithm.
	2906	CRYPT_E_UNKNOWN_ALGO = 0x80091002,
	2907	/// The object identifier is poorly formatted.
	2908	CRYPT_E_OID_FORMAT = 0x80091003,
	2909	/// Invalid cryptographic message type.
	2910	CRYPT_E_INVALID_MSG_TYPE = 0x80091004,
	2911	/// Unexpected cryptographic message encoding.
	2912	CRYPT_E_UNEXPECTED_ENCODING = 0x80091005,
	2913	/// The cryptographic message does not contain an expected authenticated attribute.
	2914	CRYPT_E_AUTH_ATTR_MISSING = 0x80091006,
	2915	/// The hash value is not correct.
	2916	CRYPT_E_HASH_VALUE = 0x80091007,
	2917	/// The index value is not valid.
	2918	CRYPT_E_INVALID_INDEX = 0x80091008,
	2919	/// The content of the cryptographic message has already been decrypted.
	2920	CRYPT_E_ALREADY_DECRYPTED = 0x80091009,
	2921	/// The content of the cryptographic message has not been decrypted yet.
	2922	CRYPT_E_NOT_DECRYPTED = 0x8009100A,
	2923	/// The enveloped-data message does not contain the specified recipient.
	2924	CRYPT_E_RECIPIENT_NOT_FOUND = 0x8009100B,
	2925	/// Invalid control type.
	2926	CRYPT_E_CONTROL_TYPE = 0x8009100C,
	2927	/// Invalid issuer and/or serial number.
	2928	CRYPT_E_ISSUER_SERIALNUMBER = 0x8009100D,
	2929	/// Cannot find the original signer.
	2930	CRYPT_E_SIGNER_NOT_FOUND = 0x8009100E,
	2931	/// The cryptographic message does not contain all of the requested attributes.
	2932	CRYPT_E_ATTRIBUTES_MISSING = 0x8009100F,
	2933	/// The streamed cryptographic message is not ready to return data.
	2934	CRYPT_E_STREAM_MSG_NOT_READY = 0x80091010,
	2935	/// The streamed cryptographic message requires more data to complete the decode operation.
	2936	CRYPT_E_STREAM_INSUFFICIENT_DATA = 0x80091011,
	2937	/// The protected data needs to be re-protected.
	2938	CRYPT_I_NEW_PROTECTION_REQUIRED = 0x00091012,
	2939	/// The length specified for the output data was insufficient.
	2940	CRYPT_E_BAD_LEN = 0x80092001,
	2941	/// An error occurred during encode or decode operation.
	2942	CRYPT_E_BAD_ENCODE = 0x80092002,
	2943	/// An error occurred while reading or writing to a file.
	2944	CRYPT_E_FILE_ERROR = 0x80092003,
	2945	/// Cannot find object or property.
	2946	CRYPT_E_NOT_FOUND = 0x80092004,
	2947	/// The object or property already exists.
	2948	CRYPT_E_EXISTS = 0x80092005,
	2949	/// No provider was specified for the store or object.
	2950	CRYPT_E_NO_PROVIDER = 0x80092006,
	2951	/// The specified certificate is self signed.
	2952	CRYPT_E_SELF_SIGNED = 0x80092007,
	2953	/// The previous certificate or CRL context was deleted.
	2954	CRYPT_E_DELETED_PREV = 0x80092008,
	2955	/// Cannot find the requested object.
	2956	CRYPT_E_NO_MATCH = 0x80092009,
	2957	/// The certificate does not have a property that references a private key.
	2958	CRYPT_E_UNEXPECTED_MSG_TYPE = 0x8009200A,
	2959	/// Cannot find the certificate and private key for decryption.
	2960	CRYPT_E_NO_KEY_PROPERTY = 0x8009200B,
	2961	/// Cannot find the certificate and private key to use for decryption.
	2962	CRYPT_E_NO_DECRYPT_CERT = 0x8009200C,
	2963	/// Not a cryptographic message or the cryptographic message is not formatted correctly.
	2964	CRYPT_E_BAD_MSG = 0x8009200D,
	2965	/// The signed cryptographic message does not have a signer for the specified signer index.
	2966	CRYPT_E_NO_SIGNER = 0x8009200E,
	2967	/// Final closure is pending until additional frees or closes.
	2968	CRYPT_E_PENDING_CLOSE = 0x8009200F,
	2969	/// The certificate is revoked.
	2970	CRYPT_E_REVOKED = 0x80092010,
	2971	/// No Dll or exported function was found to verify revocation.
	2972	CRYPT_E_NO_REVOCATION_DLL = 0x80092011,
	2973	/// The revocation function was unable to check revocation for the certificate.
	2974	CRYPT_E_NO_REVOCATION_CHECK = 0x80092012,
	2975	/// The revocation function was unable to check revocation because the revocation server was offline.
	2976	CRYPT_E_REVOCATION_OFFLINE = 0x80092013,
	2977	/// The certificate is not in the revocation server's database.
	2978	CRYPT_E_NOT_IN_REVOCATION_DATABASE = 0x80092014,
	2979	/// The string contains a non-numeric character.
	2980	CRYPT_E_INVALID_NUMERIC_STRING = 0x80092020,
	2981	/// The string contains a non-printable character.
	2982	CRYPT_E_INVALID_PRINTABLE_STRING = 0x80092021,
	2983	/// The string contains a character not in the 7 bit ASCII character set.
	2984	CRYPT_E_INVALID_IA5_STRING = 0x80092022,
	2985	/// The string contains an invalid X500 name attribute key, oid, value or delimiter.
	2986	CRYPT_E_INVALID_X500_STRING = 0x80092023,
	2987	/// The dwValueType for the CERT_NAME_VALUE is not one of the character strings. Most likely it is either a CERT_RDN_ENCODED_BLOB or CERT_RDN_OCTET_STRING.
	2988	CRYPT_E_NOT_CHAR_STRING = 0x80092024,
	2989	/// The Put operation cannot continue. The file needs to be resized. However, there is already a signature present. A complete signing operation must be done.
	2990	CRYPT_E_FILERESIZED = 0x80092025,
	2991	/// The cryptographic operation failed due to a local security option setting.
	2992	CRYPT_E_SECURITY_SETTINGS = 0x80092026,
	2993	/// No DLL or exported function was found to verify subject usage.
	2994	CRYPT_E_NO_VERIFY_USAGE_DLL = 0x80092027,
	2995	/// The called function was unable to do a usage check on the subject.
	2996	CRYPT_E_NO_VERIFY_USAGE_CHECK = 0x80092028,
	2997	/// Since the server was offline, the called function was unable to complete the usage check.
	2998	CRYPT_E_VERIFY_USAGE_OFFLINE = 0x80092029,
	2999	/// The subject was not found in a Certificate Trust List (CT,.
	3000	CRYPT_E_NOT_IN_CTL = 0x8009202A,
	3001	/// None of the signers of the cryptographic message or certificate trust list is trusted.
	3002	CRYPT_E_NO_TRUSTED_SIGNER = 0x8009202B,
	3003	/// The public key's algorithm parameters are missing.
	3004	CRYPT_E_MISSING_PUBKEY_PARA = 0x8009202C,
	3005	/// An object could not be located using the object locator infrastructure with the given name.
	3006	CRYPT_E_OBJECT_LOCATOR_OBJECT_NOT_FOUND = 0x8009202D,
	3007	/// MessageText:
	3008	/// OSS Certificate encode/decode error code base
	3009	/// See asn1code.h for a definition of the OSS runtime errors. The OSS error values are offset by CRYPT_E_OSS_ERROR.
	3010	CRYPT_E_OSS_ERROR = 0x80093000,
	3011
	3012	/// No signature was present in the subject.
	3013	TRUST_E_NOSIGNATURE = 0x800B0100,
	3014	/// A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
	3015	CERT_E_EXPIRED = 0x800B0101,
	3016	/// The validity periods of the certification chain do not nest correctly.
	3017	CERT_E_VALIDITYPERIODNESTING = 0x800B0102,
	3018	/// A certificate that can only be used as an end-entity is being used as a CA or vice versa.
	3019	CERT_E_ROLE = 0x800B0103,
	3020	/// A path length constraint in the certification chain has been violated.
	3021	CERT_E_PATHLENCONST = 0x800B0104,
	3022	/// A certificate contains an unknown extension that is marked 'critical'.
	3023	CERT_E_CRITICAL = 0x800B0105,
	3024	/// A certificate being used for a purpose other than the ones specified by its CA.
	3025	CERT_E_PURPOSE = 0x800B0106,
	3026	/// A parent of a given certificate in fact did not issue that child certificate.
	3027	CERT_E_ISSUERCHAINING = 0x800B0107,
	3028	/// A certificate is missing or has an empty value for an important field, such as a subject or issuer name.
	3029	CERT_E_MALFORMED = 0x800B0108,
	3030	/// A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
	3031	CERT_E_UNTRUSTEDROOT = 0x800B0109,
	3032	/// A certificate chain could not be built to a trusted root authority.
	3033	CERT_E_CHAINING = 0x800B010A,
	3034	/// Generic trust failure.
	3035	TRUST_E_FAIL = 0x800B010B,
	3036	/// A certificate was explicitly revoked by its issuer.
	3037	CERT_E_REVOKED = 0x800B010C,
	3038	/// The certification path terminates with the test root which is not trusted with the current policy settings.
	3039	CERT_E_UNTRUSTEDTESTROOT = 0x800B010D,
	3040	/// The revocation process could not continue - the certificate(s) could not be checked.
	3041	CERT_E_REVOCATION_FAILURE = 0x800B010E,
	3042	/// The certificate's CN name does not match the passed value.
	3043	CERT_E_CN_NO_MATCH = 0x800B010F,
	3044	/// The certificate is not valid for the requested usage.
	3045	CERT_E_WRONG_USAGE = 0x800B0110,
	3046	/// The certificate was explicitly marked as untrusted by the user.
	3047	TRUST_E_EXPLICIT_DISTRUST = 0x800B0111,
	3048	/// A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.
	3049	CERT_E_UNTRUSTEDCA = 0x800B0112,
	3050	/// The certificate has invalid policy.
	3051	CERT_E_INVALID_POLICY = 0x800B0113,
	3052	/// The certificate has an invalid name. The name is not included in the permitted list or is explicitly excluded.
	3053	CERT_E_INVALID_NAME = 0x800B0114,
	3054
2772	3055	_,
2773	3056	};